# bro question with SIEM **URL:** \ **Category:** Zeek\ **Created:** [October 31, 2014, 7:45pm UTC](https://community.zeek.org/t/bro-question-with-siem/3340 "2014-10-31T19:45:58Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![Allen\_Brian](https://avatars.discourse-cdn.com/v4/letter/a/73ab20/32.png) [@Allen\_Brian](https://community.zeek.org/u/Allen_Brian)\ **Post date:** [October 31, 2014, 7:45pm UTC](https://community.zeek.org/t/bro-question-with-siem/3340/1 "2014-10-31T19:45:58Z")
Hi - Our Medschool uses the IBM Qradar SIEM tool, and we have a project to expand it to cover the rest of the University. Since we have a SEIM now, I figured I might as well put the best logs I have in it - which include BRO logs: http, dns, conn, etc. IBM is asking me the following question: Is BRO able to forward raw flow data that has not been normalized or altered? I’m pretty sure the answer is no because I have worked with raw flow data with flow-tools a lot, but I wanted to post it here to make sure, plus see if anyone is using BRO with a SIEM and what those setups might look like. Thanks, -Brian Brian Allen, CISSP Information Security Manager Washington University [brianallen@wustl.edu](mailto:brianallen@wustl.edu) 314-935-5380 ---
**Author:** ![Brant\_Hale](https://avatars.discourse-cdn.com/v4/letter/b/da6949/32.png) [@Brant\_Hale](https://community.zeek.org/u/Brant_Hale)\ **Post date:** [October 31, 2014, 8:08pm UTC](https://community.zeek.org/t/bro-question-with-siem/3340/2 "2014-10-31T20:08:51Z")
Brian, I also have Qradar and am looking to supplement it with BRO - mainly the Security Onion platform. The systems have some overlap, I suspect that they are just going to want raw network data as they have their own tools to pull info out. I am planning on sending my syslog data to Qradar and pulling the BRO data from a network tap. So both systems will run in parallel not one reporting to the other. Do let us know what you end up with. Brant ---
**Author:** ![Slagell\_Adam\_J](https://avatars.discourse-cdn.com/v4/letter/s/e9c0ed/32.png) [@Slagell\_Adam\_J](https://community.zeek.org/u/Slagell_Adam_J)\ **Post date:** [October 31, 2014, 8:15pm UTC](https://community.zeek.org/t/bro-question-with-siem/3340/3 "2014-10-31T20:15:02Z")
You could send the logs or even the raw bro events. I’m not sure what they mean by raw flow data, but am guessing they mean like v9 netflows. That it won’t do. ---
**Author:** ![Ron\_Jenkins](https://avatars.discourse-cdn.com/v4/letter/r/ba8739/32.png) [@Ron\_Jenkins](https://community.zeek.org/u/Ron_Jenkins)\ **Post date:** [October 31, 2014, 8:44pm UTC](https://community.zeek.org/t/bro-question-with-siem/3340/4 "2014-10-31T20:44:39Z")
We setup the Linux’s Syslog-NG v3x to monitor and forward the logs to Log Siphon’s Syslog daemon. Below is a example syslog.conf setup. Thanks! _Below is the sample settings for syslog-ng.conf concerning sending the Bro2 logs to Log Siphon; items in dark red ARE required._ - _#BRO IDS_ _source s1\_broHttp { file("/opt/bro2/spool/bro/http.log" follow\_freq(1)); };_ _source s1\_broConn { file("/opt/bro2/spool/bro/conn.log" follow\_freq(1)); };_ _source s1\_broDNS { file("/opt/bro2/spool/bro/dns.log" follow\_freq(1)); };_ _source s1\_broFILES { file("/opt/bro2/spool/bro/files.log" follow\_freq(1)); };_ _source s1\_broSMTP { file("/opt/bro2/spool/bro/smtp.log" follow\_freq(1)); };_ _source s1\_broSMTPentities { file("/opt/bro2/spool/bro/smtp\_entities.log" follow\_freq(1)); };_ _source s1\_broSoftware { file("/opt/bro2/spool/bro/software.log" follow\_freq(1)); };_ _source s1\_broSNMP { file("/opt/bro2/spool/bro/snmp.log" follow\_freq(1)); };_ _source s1\_broSSL { file("/opt/bro2/spool/bro/ssl.log" follow\_freq(1)); };_ _source s1\_broDPD { file("/opt/bro2/spool/bro/dpd.log" follow\_freq(1)); };_ _source s1\_broNotice { file("/opt/bro2/spool/bro/notice.log" follow\_freq(1)); };_ _source s1\_broSSH { file("/opt/bro2/spool/bro/ssh.log" follow\_freq(1)); };_ _source s1\_broSYSLOG { file("/opt/bro2/spool/bro/syslog.log" follow\_freq(1)); };_ _source s1\_broFTP { file("/opt/bro2/spool/bro/ftp.log" follow\_freq(1)); };_ _source s1\_broTUNNEL { file("/opt/bro2/spool/bro/tunnel.log" follow\_freq(1)); };_ _source s1\_broX509 { file("/opt/bro2/spool/bro/x509.log" follow\_freq(1)); };_ Ron Jenkins (Owner / Senior Architect) **RMJ Consulting, LLC.** “_Bringing Companies and Solutions Together_” 11715 Bricksome Ave STE B-7 Baton Rouge, LA 70816 **Toll:** 855-448-5214 **Direct**. 225-448-5214 Ext #101 **Fax.** 225-448-5324 **Cell.** 225-931-1632 **Email.** [rjenkins@rmjconsulting.net](mailto:rjenkins@rmjconsulting.net) **Web.** [http://www.rmjconsulting.net](http://www.rmjconsulting.net/) **Log Siphon**. [http://www.logsiphon.com](http://www.logsiphon.com/) **Linkedin.** [www.linkedin.com/in/ronmjenkins/](http://www.linkedin.com/in/ronmjenkins/) **Twitter** \*\*:\*\* [www.twitter.com/RMJConsulting](http://www.twitter.com/RMJConsulting) **RMJ Consulting’s Technology Corner.** [https://www.rmjconsulting.net/main/paper.php](https://www.rmjconsulting.net/main/paper.php) ---
**Author:** ![Mike\_Patterson](https://avatars.discourse-cdn.com/v4/letter/m/f475e1/32.png) [@Mike\_Patterson](https://community.zeek.org/u/Mike_Patterson)\ **Post date:** [October 31, 2014, 10:51pm UTC](https://community.zeek.org/t/bro-question-with-siem/3340/5 "2014-10-31T22:51:20Z")
They definitely mean netflowv5 or 9. Bro can’t do this, but you probably could generate flows from the same device you’re running Bro on. I’m pretty sure there are some open source options here. ---
**Author:** ![Slagell\_Adam\_J](https://avatars.discourse-cdn.com/v4/letter/s/e9c0ed/32.png) [@Slagell\_Adam\_J](https://community.zeek.org/u/Slagell_Adam_J)\ **Post date:** [October 31, 2014, 11:01pm UTC](https://community.zeek.org/t/bro-question-with-siem/3340/6 "2014-10-31T23:01:13Z")
We were going to do that once with Bro & Argus on the same boxes. But then we got better flow data from the routers with a network upgrade and moved to just setting up a single collector box. ---
**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\ **Post date:** [May 6, 2022, 3:42pm UTC](https://community.zeek.org/t/bro-question-with-siem/3340/7 "2022-05-06T15:42:12Z")
Closed on May 6, 2022, 3:42pm UTC